Few-Shot Learning for Network Intrusion Detection: Methods, Datasets, and Performance

2026-09-10

AI Summary

本文通过系统回顾2022至2026年间发布的基于少样本学习（FSL）的网络入侵检测方法，解决了新攻击类型训练数据不足的问题。

Abstract

Anomaly-based network intrusion detection systems (NIDS) are an important first line of defense. However, training NIDS for new attack types is challenging, because labeled attack data are rarely available. Few-shot learning (FSL) addresses this problem by learning from few samples. However, the approaches and evaluation settings, that have been investigated so far, vary widely. This work systematically reviews FSL approaches for NIDS published from 2022 to 2026. We conduct a systematic literature review with PRISMA 2020-like reporting to search ACM Digital Library, IEEE Xplore, and Scopus. From a set of 1,358 initial records, we retain 21 studies after screening, deduplication, and quality filtering. We classify the applied FSL approaches, datasets, and experimental parameters and compare reported performance. Meta-learning and convolutional neural networks are the most common approaches, with 8 and 10 studies, respectively. Most studies evaluate five or fewer samples per class, although settings vary. CIC-IDS2017 and CSE-CIC-IDS2018 are the most frequently used datasets. Missing parameters and source code limit reproducibility and direct comparison between approaches.

Problem

• Few-shot learning
• Network intrusion detection systems
• Anomaly-based NIDS
• Labeled attack data

Innovation

• Few-shot learning
• Network Intrusion Detection Systems
• Meta-learning
• Convolutional Neural Networks
• CIC-IDS2017